fix(pager): treat a truncated header slot as absent, not fatal

A file cut short mid-slot is the same recoverable condition as a slot
that fails its HK-MAC check: the A/B protocol is designed to survive
exactly one unusable slot. Add read_header_slot, which maps a
short/EOF read to an absent slot so the caller's usual decode rejects
it like any other damaged copy, and route both header-reading call
sites through it so the surviving slot still opens the database.

Author: farhan-syah

src/pager/header.rs

@@ -82,6 +82,28 @@ pub async fn bootstrap_header<V: Vfs>(
 /// Open an existing main.db, return the active header fields and which slot
 /// they came from.
 ///
+/// Read one header slot into `buf`, treating an incomplete slot as an
+/// unverifiable one rather than as a fatal error.
+///
+/// The A/B protocol survives one unusable slot by design, and a file truncated
+/// mid-slot is exactly that case: the surviving copy must still open the
+/// database. `buf` keeps whatever prefix was transferred, so the caller's
+/// ordinary decode rejects it on the magic or HK-MAC check like any other
+/// damaged slot. Every other backend error propagates unchanged — only
+/// end-of-file is absence.
+pub(crate) async fn read_header_slot<F: VfsFile + ?Sized>(
+    file: &mut F,
+    offset: u64,
+    buf: &mut [u8],
+) -> Result<()> {
+    match read_exact_at(file, offset, buf).await {
+        Err(PagedbError::Io(ref error)) if error.kind() == std::io::ErrorKind::UnexpectedEof => {
+            Ok(())
+        }
+        other => other,
+    }
+}
+
 /// Reads both slots; verifies each via HK-MAC; picks the one with the
 /// greater `seq`. If only one verifies, it wins. If neither verifies, returns
 /// `Corruption(HeaderUnverifiable)` — unrecoverable from inside the header
@@ -95,10 +117,10 @@ pub async fn open_header<V: Vfs>(
     let mut f = vfs.open(path, OpenMode::ReadWrite).await?;
     let mut buf_a = vec![0u8; page_size];
     let mut buf_b = vec![0u8; page_size];
-    read_exact_at(&mut f, 0, &mut buf_a).await?;
+    read_header_slot(&mut f, 0, &mut buf_a).await?;
     let page_size_u64 = u64::try_from(page_size)
         .map_err(|_| PagedbError::Io(std::io::Error::other("page_size > u64")))?;
-    read_exact_at(&mut f, page_size_u64, &mut buf_b).await?;
+    read_header_slot(&mut f, page_size_u64, &mut buf_b).await?;
     let a = decode_main_db_header(&buf_a, hk, page_size).ok();
     let b = decode_main_db_header(&buf_b, hk, page_size).ok();
     match (a, b) {

src/txn/db/open/existing.rs

@@ -10,9 +10,10 @@ use crate::crypto::{CipherId, SecretKey};
 use crate::errors::PagedbError;
 use crate::options::OpenOptions;
 use crate::pager::header::ActiveSlot;
+use crate::pager::header::read_header_slot;
 use crate::pager::structural_header::MainDbHeaderFields;
 use crate::pager::{Pager, PagerConfig};
-use crate::vfs::{Vfs, read_exact_at};
+use crate::vfs::Vfs;
 use crate::{RealmId, Result};
 
 use super::super::super::mode::DbMode;
@@ -107,10 +108,10 @@ impl<V: Vfs + Clone> Db<V> {
         let mut f = vfs.open(&main_db_path, file_mode).await?;
         let mut buf_a = vec![0u8; page_size];
         let mut buf_b = vec![0u8; page_size];
-        read_exact_at(&mut f, 0, &mut buf_a).await?;
+        read_header_slot(&mut f, 0, &mut buf_a).await?;
         let page_size_u64 = u64::try_from(page_size)
             .map_err(|_| PagedbError::Io(std::io::Error::other("page_size > u64")))?;
-        read_exact_at(&mut f, page_size_u64, &mut buf_b).await?;
+        read_header_slot(&mut f, page_size_u64, &mut buf_b).await?;
         drop(f);
 
         let try_decode = |buf: &[u8]| -> Option<(MainDbHeaderFields, bool)> {

src/txn/db/util.rs

@@ -4,7 +4,8 @@
 use crate::Result;
 use crate::crypto::kdf::{derive_hk, derive_mk};
 use crate::errors::PagedbError;
-use crate::vfs::{Vfs, read_exact_at};
+use crate::pager::header::read_header_slot;
+use crate::vfs::Vfs;
 
 pub(super) fn page_size_log2(page_size: usize) -> Result<u8> {
     match page_size {
@@ -42,10 +43,10 @@ pub(super) async fn peek_restore_mode<V: Vfs + Clone>(
     let mut f = vfs.open("/main.db", OpenMode::Read).await?;
     let mut buf_a = vec![0u8; page_size];
     let mut buf_b = vec![0u8; page_size];
-    read_exact_at(&mut f, 0, &mut buf_a).await?;
+    read_header_slot(&mut f, 0, &mut buf_a).await?;
     let page_size_u64 = u64::try_from(page_size)
         .map_err(|_| PagedbError::Io(std::io::Error::other("page_size > u64")))?;
-    read_exact_at(&mut f, page_size_u64, &mut buf_b).await?;
+    read_header_slot(&mut f, page_size_u64, &mut buf_b).await?;
     drop(f);
 
     for buf in [&buf_a, &buf_b] {

tests/header.rs

@@ -259,3 +259,55 @@ async fn open_picks_higher_seq_when_both_verify() {
     assert_eq!(slot, ActiveSlot::B);
     assert_eq!(got.counter_anchor, 9000);
 }
+
+/// A file truncated mid-slot must still open on the surviving copy.
+///
+/// The A/B protocol exists so that one unusable slot is survivable. Reading a
+/// slot short is the same condition as a slot that fails its HK-MAC: absent,
+/// not fatal. Rejecting the open outright would throw away the intact header
+/// sitting in the other slot.
+#[tokio::test(flavor = "current_thread")]
+async fn open_survives_a_file_truncated_inside_the_inactive_slot() {
+    let vfs = MemVfs::new();
+    let hk = hk();
+    bootstrap_header(&vfs, "/main.db", &hk, &sample(1, 12, 4242), 4096)
+        .await
+        .unwrap();
+
+    // Slot A is intact; slot B is cut in half.
+    let mut f = vfs.open("/main.db", OpenMode::ReadWrite).await.unwrap();
+    f.truncate(4096 + 2048).await.unwrap();
+    f.sync().await.unwrap();
+    drop(f);
+
+    let (got, slot) = open_header(&vfs, "/main.db", &hk, 4096)
+        .await
+        .expect("the intact slot must still open the database");
+    assert_eq!(slot, ActiveSlot::A);
+    assert_eq!(got.seq, 1);
+    assert_eq!(got.counter_anchor, 4242);
+}
+
+/// With neither slot readable, the header layer still reports corruption
+/// rather than leaking a raw end-of-file error.
+#[tokio::test(flavor = "current_thread")]
+async fn open_reports_corruption_when_truncation_takes_both_slots() {
+    let vfs = MemVfs::new();
+    let hk = hk();
+    bootstrap_header(&vfs, "/main.db", &hk, &sample(1, 12, 0), 4096)
+        .await
+        .unwrap();
+
+    let mut f = vfs.open("/main.db", OpenMode::ReadWrite).await.unwrap();
+    f.truncate(0).await.unwrap();
+    f.sync().await.unwrap();
+    drop(f);
+
+    let err = open_header(&vfs, "/main.db", &hk, 4096)
+        .await
+        .expect_err("a file with no readable slot must not open");
+    assert!(
+        matches!(err, PagedbError::Corruption(_)),
+        "expected Corruption, got {err:?}"
+    );
+}